petropy
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external Log ASCII Standard (LAS) files, which represents an ingestion surface for untrusted data.
- Ingestion points: Well log data is loaded via
lasio.read()inscripts/formation_evaluation.py. - Boundary markers: The skill does not use specific delimiters for the LLM context, but it operates as a controlled CLI tool where the LLM acts as the operator.
- Capability inventory: The skill is restricted to file system read/write for LAS and JSON files and numeric processing via PetroPy/NumPy. It lacks network access or dynamic execution (eval/exec) capabilities.
- Sanitization: The
scripts/formation_evaluation.pyscript implements rigorous validation, including unit verification (API, g/cm³, ohm·m), depth monotonicity checks, physical bounds testing (0 ≤ Sw ≤ 1), and a 100% bulk volume closure requirement (matrix + pores = 1.0). These checks effectively mitigate the risk of malformed or malicious data influencing downstream logic.
Audit Metadata